peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

headscale: use architect options

Browse Source
This commit is contained in:
Giulio De Pasquale 2024-01-31 00:33:56 +01:00
parent 946e185c99
commit 7cf37954ef
1 changed files with 33 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
hosts/architect/headscale.nix
View File

@ -1,53 +1,46 @@
{ config, pkgs, lib, ... }: { config, pkgs, ... }:
let let
domain = "vipienne.giugl.io"; baseDomain = "giugl.io";
domain = "vipienne.${baseDomain}";
headscalePkg = pkgs.unstablePkgs.headscale;
in in
{ {
environment.systemPackages = [ pkgs.headscale ]; environment.systemPackages = [ headscalePkg ];
architect.firewall = { architect = {
openUDP = [ config.services.tailscale.port ]; firewall = {
}; openUDP = [ config.services.tailscale.port ];
services = {
headscale = {
enable = true;
package = pkgs.unstablePkgs.headscale;
port = 1194;
address = "0.0.0.0";
settings = {
server_url = "https://${domain}";
log.level = "debug";
dns_config = {
magic_dns = true;
base_domain = "giugl.io";
override_local_dns = true;
nameservers = [ config.architect.networks.tailscale.devices.architect.address ];
};
logtail.enabled = false;
ip_prefixes = [ config.architect.networks.tailscale.net ];
noise.private_key_path = "/var/lib/headscale/noise_private.key";
};
}; };
nginx.virtualHosts.${domain} = { vhost.${domain} = {
forceSSL = true; dnsInterfaces = [ "lan" "tailscale" ];
enableACME = true;
extraConfig = ''
ssl_protocols TLSv1.2 TLSv1.3;
'';
locations."/" = { locations."/" = {
proxyPass = port = config.services.headscale.port;
"http://127.0.0.1:${toString config.services.headscale.port}"; allowWAN = true;
proxyWebsockets = true; proxyWebsockets = true;
recommendedProxySettings = true;
extraConfig = ''
proxy_buffering off;
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
'';
}; };
}; };
}; };
services.headscale = {
enable = true;
package = headscalePkg;
settings = {
server_url = "https://${domain}";
log.level = "debug";
dns_config = {
magic_dns = false;
base_domain = baseDomain;
override_local_dns = true;
nameservers = [
config.architect.networks.tailscale.devices.architect.address
];
};
logtail.enabled = false;
ip_prefixes = [ config.architect.networks.tailscale.net ];
noise.private_key_path = "/var/lib/headscale/noise_private.key";
};
};
} }